Privacy policy

HITOP does not collect, sell or share personal data, and you never need an account. The one exception is optional: the hitop sync test server keeps an account and a security log if you sign in to it (see below). Last updated 3 November 2026.

What stays on your device

Everything you enter, including collections, requests, headers, variables, scripts and request history, is stored only on your device:

• macOS app and CLI on macOS: ~/Library/Application Support/hitop/
• CLI on Linux: ~/.config/hitop/
• CLI on Windows: %APPDATA%\hitop\
• iOS app: the app's own storage on your iPhone or iPad
• Web app and browser extensions: your browser's local storage

None of it leaves your device unless you export it yourself.

Requests you send

The Mac app, the iOS app, the CLI and the browser extensions send each request straight from your device to the address you entered. HITOP's servers are not involved.

The web app at hitop.rws8.tech sends requests to public addresses through the HITOP request proxy on the same server, because browsers block most cross origin API calls. For those requests:

• The proxy receives the method, URL, headers and body you send, makes the request, and returns the response to your browser.
• It does not store requests, responses, headers or bodies, and does not log them. The web server's access log records your IP address, the time and the path /api/proxy, not where the request went.
• It refuses private and internal addresses. Requests to localhost and other private addresses are never sent to the proxy; your browser sends them itself.
• Don't send secrets you are not comfortable passing through a server you don't run. For those, use the Mac or iOS app, the CLI or an extension.

No tracking

HITOP contains no analytics SDKs, crash reporting, advertising identifiers, third party SDKs, session recording or fingerprinting. The website sets no cookies. If you choose a light or dark theme, your browser keeps that choice in local storage under hitop-theme.

Usage ping, only if you turn it on

The CLI (from version 0.3.0) and the free desktop builds from GitHub can send one anonymous ping a week, only if you turn it on. It is off by default; the desktop app asks once, with No as the default answer, and the CLI only sends it after hitop telemetry on. The Mac App Store and iOS apps, the web app and the browser extensions don't contain this code at all.

• The ping holds a random install id made on your device, which surface it is (CLI or desktop), the version and the operating system family. Nothing else: no requests, URLs, collections or account.
• It goes to https://hitop.rws8.tech/api/ping. The server keeps only daily counts. It uses the install id to count each install once a week, through a hash with a salt that is thrown away every week, so installs can't be followed from week to week. It doesn't store your IP address; the web server's access log records it with the time and the path, as for any page.
• Turn it off at any time with hitop telemetry off or in the desktop app's settings. hitop telemetry status shows what would be sent.

hitop sync test server, only if you sign in

hitop sync is optional and in testing. If you sign in to the test server at sync.hitop.rws8.tech to share collections, it keeps:

• Your email address, your devices' public keys and names, and hashes of your sign-in and session tokens (never the tokens).
• If you set a password: never the password itself. Your app turns it into two keys on your device; the server gets one of them and keeps only a slow hash of it, plus the settings your app needs to turn the password into keys again. The other key seals your device's keys (a key bundle the server stores but can't open), so the password unlocks your workspaces on a new device. If you sign in with Google or GitHub, the server keeps which Google or GitHub account it was (its id and email address); it never sees your Google or GitHub password and keeps no token from them.
• Your shared workspaces only as ciphertext: files are encrypted on your device before they are sent, and the server can't read them. It sees who is in which workspace, how many files there are, their sizes and when they change.
• Run history, only if your runs upload it (hitop run --sync-report): per run a status row the server can read (passed or failed, time, duration, request counts, the collection's and the environment's names, and failed request names only if the workspace's owners allow it), and the full report encrypted on your runner so the server can't read it. Alert settings (members' addresses, webhook URLs) are kept so the server can send alerts; an alert holds the status and a link, never a response or a secret value.
• Secret values never sync unless you share them: an environment's values shared with hitop sync secrets share are encrypted for the devices you pick, and the server can't read them.
• An audit log of security events: sign-ins and failed sign-ins, sign-outs, device keys, and in a workspace members added or removed, role changes, invites, key rotations and runner credentials. Each entry holds the time, the account, what it was done to, the first three parts of your IP address (the last part is dropped, IPv6 to its first 48 bits) and your app's user agent. Workspace owners can read their workspace's entries; you can read your own sign-ins. Entries are deleted after a year.

Delete a workspace in the app or with hitop sync; email bohdaq@gmail.com to have your account removed. A sync server someone else runs, for example your employer's, keeps what its operator configures.

HITOP Cloud plans, only if you buy one

Paid HITOP Cloud plans are sold by Lemon Squeezy as merchant of record. Lemon Squeezy collects your name, address, payment details and tax information under its own privacy policy; HITOP never sees your card. The sync server keeps your organization's plan, seats, status and the Lemon Squeezy subscription, order and customer ids, plus the ids and outcomes of Lemon Squeezy's notifications (not their content). A Team trial records the organization, the account that started it and its email domain, so each gets one trial.

Children

HITOP does not knowingly collect information from anyone, including children under 13.

Changes

If this policy changes, the new version is posted at this address with a new date.

Contact

Email bohdaq@gmail.com or open an issue on GitHub.